The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text requests and existing SVG files, which creates an attack surface for indirect prompt injection.
Ingestion points: User request strings are processed by scripts/route_style.py; existing SVG files are loaded and transformed by scripts/convert_svg.py and rendered by scripts/render_svg.py.
Boundary markers: The skill does not implement explicit delimiters or warnings to ignore instructions within user-supplied data.
Capability inventory: The skill can execute shell commands (examples/src/make_showcase.py), perform file system read/write operations, and launch a headless browser instance (scripts/render_svg.py).
Sanitization: scripts/validate_svg.py includes checks to identify and warn about <script> tags and on* event handlers within ingested SVGs.
[COMMAND_EXECUTION]: The script examples/src/make_showcase.py uses subprocess.run to execute internal utility scripts (render_svg.py, pixel_grid.py) during the generation of showcase assets. This is a low-risk behavior consistent with the tool's intended use for development and demonstration.

create-svg